Firstly, thank you whomever is reading this message. It's been a mindboggling endeavor for the past week to identify what is incorrect and causing my PC to act as it is. I've looked everywhere and tried everything to get rid of this item, however, alas, with no result - actually just making it worse I think. I hope that you can be of help and thank you for your time.

I've identified that I have the searchexe issue on my computer. Yet I think there are more issues since I cannot open IE anymore, and various functions on my start menu/shortcuts (start menu e.g. search files/folders, short cuts - IE doesn't open (although when I run task manager it shows it is running)) do not function anymore.

I have downloaded/run numerous spyware programs - Xosftspy, Ad-Aware 6.0, norton, Stinger (Mcafee), SpyHunter and numerous others I unfortunately cannot recall the names of, that have identified the problems on my pc, and supposedly deleted it. Still, I have not gotten rid of the searchexe "bug" for lack of better term.

I am attaching my HijackThis logs, in hope that possibly you could help me idenitify what I would need to do.

C:\WINNT\SYSTEM32\DNTUS26.EXE can be monitoring software if this computer is owned by a company office..etc I'm guessing it is just used as a trojan.

On my Win2000 fresh install, I had TaskMgnr.exe all over the place, and would return on every reboot.
You actually can't clean a Win2000 computer unless you have it patched to date, or you'll have this stuff back on the next reboot.. TaskMgnr.exe you didn't download, it just migrates into the system when you are online.

Download a Firewall somewhere(even if just to stay protected until all MS Updates can be installed), and open network connections and find your Adapter used to connect to the Internet...uncheck File and Printer sharing for MS Networks

I couldnt see the top portion of the HJT log so I don't know what Service packs you have installed.
You can check if you are at least patched with the 2 most critical patches MS_KB824146 use my Utility click "Am I patched" and wait for status.

It’s taken me a few hours to go through all the different items you suggested, but all I can say as an end-result is -- Wow! How wonderful my computer is working so far. Thank you. I did want to run down what I did (for other people to possibly benefit) – and would have not known without your guidance.

1. I followed your (flman1) instruction to run the HijackThis log again and deleted the files.
2. Started in safe menu and deleted all files except one (C:\WINNT\system32\sna.exe) I couldn’t find it. Below I’ve included the detail of the files I deleted. Thought this may be of help to you.
3. Per OE’s recommendation, downloaded a Security Internet software with a firewall (I had some security, but not enough)
4. and updated my MS 2000 to newest patch – 4.

So, after all this I can say… Wonderful!!!

1. searchexe is gone! It really is a nasty bugger…
2. I can open my files again! My computer, my search in start up menu etc. (Very happy)
3. and believe it or not, my menus and startup looks a little different (like it used to) and my explorer, windows is working extremely fast

Lastly, I ran as you recommended the TaskMgr.exe. Unfortunately, the file must be very big, since I only received an error message page after I submitted the file on your recommended link.

Lastly, per your recommendation, I think there are still some issues with my computer. I will post my current Hijackthis log in a separate posting. I do want to try to figure out what else I need to delete and get rid of. **Note that in my review in safe mode I came across a very questionable application – (two different files) – drwatson, DRWTSN32. I do not think this is supposed to be in my system. Any suggestions?

Here are the details of the files I deleted – hopefully this gives you some insight or help moving forward with other people running into this problem:

Hi again, Here is my latest, up-to-date HijackThis file.... Thank you! If you see anything that is questionable, do appreciate you letting me know. Also, I checked the drwatson files and they gave me an OK result. So I suppose these files are legit.

Thank you flrman1. For some reason I cannot find the file C:\Program files\BROWSE... folder in safe mode or when looking at my program files. I've even gone through the different folders to see if it is there, but can't seem to find it.

Thank you very much for your help. I'll make sure to recommend your help and the site to my friends.

the more I look at it , the more it looks as something you never purposely installed. add it to the KillBox as well and kill it.
All these files will be backed up if we need them to restore, submit etc.
This is a little easier than finding files manually in safe mode.
Do that then post new HiJackThis log

Yea, the whole OEM folder and whatever is inside should be deleted.
As for the trojan, just looking at info on the DNTUS26.EXE , I can't get any 100% answer on it, but it always looks suspicious.

This Link makes this look very bad. Thats why i say..Kill it, if need be you can always put it back.

Also there is no startup entry for it..yet it runs.. so it's either running as a service or being started by something else. It claims to be part of legitimate "Monitoring software" yet i see no reference to any legitimate company name etc.

dunno what to say, i wouldn't let that thing run on my system unless i had some hard info as to why it was needed, and what installed it.

Hello flrman1 and OE. Thank you for all your input. It appears however that I cannot find the certain files that you are requesting me to delete. I feel somewhat lost, since it appears you can see them on my logs, and I can't find them on my computer.

I found only two of the eight files OE pointed out, which I deleted (through the link provided):

Files found and deleted:
c:\winnt\system32\drivers\disdn\OEM\WinNt.exe
C:\WINNT\SYSTEM32\DNTUS26.EXE

I've attached in the document some of my search results and also screen views for you to see what is in the OEM folder - really not sure where the files are - I've also used search to find them and they were not on my system. Apart from one (WinMgmt). I've included my search result for that file since I'm not sure if these are the files you want me to delete. Please see attached doc.

Lastly, unfortunately, I still cannot find any files that have "Browse" in my program files or c drive. I've looked through most of the folders to try to see if it's possibly in another folder. Also, I've searched for the online plan.exe and cannot find it. Not sure what to do?

I am posting my hijack this logs again as well. Thank you!!

I've attached the screengrabs and hijack this files in the techguy_files.doc

Attachment Blocked

Attachments in the HJT forum are often designed to solve a specific issue and not meant to be used without instructions specific to your computer. If you want help specific to your computer, please post a HiJackThis Log. If you started this thread, please make sure you are logged in to be able to view attachments.